On the Performance of Pippenger's algorithm for Multi-Scalar Multiplication

Abstract

Multi-scalar multiplication (MSM) is core to many zero-knowledge succinct non-interactive argument of knowledge (zk-SNARK) systems and remains a primary performance bottleneck in proof generation and verification. In practice, zk-SNARK implementations typically rely on Pippenger’s bucket method as the standard algorithm for MSM. This thesis targets high-throughput MSM, computing many scalar–point multiplications and summing them for a large number of scalars, up to $2^{21}$ on a specific curve, with the primary goal of reducing the number of group operations.

Our work consists of three main parts. First, we review background and classical MSM algorithms, with more focus on standard Pippenger's method, Pippenger's with Booth encoded digits and the Bos–Coster approach. Second, we apply a family of small-factor scalar recoding techniques that extract small factors to shorten the effective scalar bitlength, and we compare the number of point operations for the afore-mentioned methods. Third, we introduce a strategy to reduce the number of point operations in Pippenger's algorithm. It is based on clustering of scalar window digits across multiple rows. Firstly, we describe the simplest case of window digit clustering in individual columns and then its generalization to window digit clustering in multiple columns. We implement these ideas in Rust, study sensitivity to window size, and evaluate combinations of recoding and reuse.

Across our benchmarks, multiple columns window digit clustering reduces total point operations by \(2.59\%\)–\(18.09\%\) relative to Booth encoded Pippenger's method, while individual column clustering yields improvements up to $8 \%$ for small number of scalars. Overall, structured reuse together with modest window tuning provides consistent operation savings, indicating a practical path to faster MSMs at scale.